CVE-2024-21412: Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability
Vulnerability summary
CVE-2024-21412 is a high (CVSS 8.1) Protection Mechanism Failure vulnerability in Microsoft Windows. It is known to be exploited: CISA lists it, first on 13-02-2024. It has been used in ransomware campaigns. EPSS estimates a 99.41% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities.
Timeline
- 13-02-2024PublishedVulnerability first disclosed.
- 13-02-2024Added to CISA KEVMicrosoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability
- 05-03-2024CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- 10-08-2026Last modifiedVulnerability information updated.
Description
Internet Shortcut Files Security Feature Bypass Vulnerability
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST8.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
EPSS trend
Probability
99.41%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
+3.97 pp
From 95.44% on 21-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 13-02-2024
- Federal due date
- 05-03-2024
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21412 nvd.nist.gov/vuln/detail/CVE-2024-21412
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Microsoft18 products
- windows_10_1809< 10.0.17763.5458
- windows_10_21h2< 10.0.19044.4046
- windows_10_22h2< 10.0.19045.4046
- windows 10 version 1809≥ 10.0.0, < 10.0.17763.5458 | ≥ 10.0.17763.0, < 10.0.17763.5458
- windows 10 version 21h2≥ 10.0.19043.0, < 10.0.19044.4046
1 vendor · 18 products
References
2 links
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21412Government ResourceUS Government Resource